Bug 162693 - Signature is valid notification although I don't trust the intermediate certificate authority which signed the certificate used to sign the document.
Summary: Signature is valid notification although I don't trust the intermediate certi...
Status: UNCONFIRMED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
24.2.3.2 release
Hardware: All Windows (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: QA:needsComment
Keywords:
Depends on:
Blocks:
 
Reported: 2024-08-29 13:55 UTC by Chan Staya
Modified: 2024-09-13 03:13 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chan Staya 2024-08-29 13:55:25 UTC
Description:
When opening a signed document a message is displayed which states that the signature is valid although the intermediate CA isn't trusted in Windows' certificate storage. In the document's "Digital Signature" window it is stated correctly that the signature couldn't be verified.

Steps to Reproduce:
1. Sign a document with a certificate issued by an intermediate CA
2. Remove the intermediate CA from Windows certificate storage (you keep trusting the root ca!)
3. Reopen the prior signed document

Actual Results:
A message is shown that the document is signed and that the signature is valid 

Expected Results:
A message should be shown which states that at least one signature has problem because of unvalidatable certificate


Reproducible: Always


User Profile Reset: Yes

Additional Info:
Version: 24.2.3.2 (X86_64) / LibreOffice Community
Build ID: 433d9c2ded56988e8a90e6b2e771ee4e6a5ab2ba
CPU threads: 4; OS: Windows 10.0 Build 19045; UI render: Skia/Raster; VCL: win
Locale: de-DE (de_DE); UI: de-DE
Calc: threaded

Also tested: version 24.2.3.2 and 24.8.1.1 on Windows 11


On this Linux version it behaves as expected:

Version: 7.3.7.2 / LibreOffice Community
Build ID: 30(Build:2)
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: de-DE (en_US.UTF-8); UI: en-US
Ubuntu package version: 1:7.3.7-0ubuntu0.22.04.6
Calc: threaded


I executed the steps above in safe mode and the problem occurs there as well.

Before issuing this bug report, I opened a forum thread here: 
https://ask.libreoffice.org/t/digital-signature-in-windows-client-is-shown-as-valid-although-it-shouldnt/110106/2